MAL-2025-22398 Malicious code in hermes-paleontology-taurus-wavefunction (npm)

The package hermes-paleontology-taurus-wavefunction was found to contain malicious code...

MAL-2025-15712 Malicious code in biosignature-bionics-bionics-hermes (npm)

The package biosignature-bionics-bionics-hermes was found to contain malicious code...

MAL-2025-16323 Malicious code in build-extremophile-hermes-mysql (npm)

The package build-extremophile-hermes-mysql was found to contain malicious code...

MAL-2025-37956 Malicious code in ursa-run-script-hermes-bulma (npm)

The package ursa-run-script-hermes-bulma was found to contain malicious code...

MAL-2025-22396 Malicious code in hermes-fornax-typeorm-shelljs (npm)

The package hermes-fornax-typeorm-shelljs was found to contain malicious code...

Malicious code in dorado-aldebaran-hermes-react-bootstrap (npm)

The package dorado-aldebaran-hermes-react-bootstrap was found to contain malicious code...

Malicious code in hermes-paleontology-taurus-wavefunction (npm)

The package hermes-paleontology-taurus-wavefunction was found to contain malicious code...

Malicious code in biosignature-bionics-bionics-hermes (npm)

The package biosignature-bionics-bionics-hermes was found to contain malicious code...

Malicious code in airbnb-hermes-redis-umbriel (npm)

The package airbnb-hermes-redis-umbriel was found to contain malicious code...

Malicious code in csv-hermes-cryonics-solis (npm)

The package csv-hermes-cryonics-solis was found to contain malicious code...

MAL-2025-34199 Malicious code in superagent-process-hermes-antares (npm)

The package superagent-process-hermes-antares was found to contain malicious code...

Malicious code in hermes-orbit-eslint-config-comet (npm)

The package hermes-orbit-eslint-config-comet was found to contain malicious code...

Hermes: High-Performance Homomorphically Encrypted Vector Databases

Whitepaper called Hermes: High-Performance Homomorphically Encrypted Vector Databases...

CVE-2023-30470

A use-after-free related to unsound inference in the bytecode generation when optimizations are enabled for Hermes prior to commit da8990f737ebb9d9810633502f65ed462b819c09 could have been used by an attacker to achieve remote code execution. Note that this is only exploitable in cases where Herme...

CVE-2023-28081

A bytecode optimization bug in Hermes prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could be used to cause an use-after-free and obtain arbitrary code execution via a carefully crafted payload. Note that this is only exploitable in cases where Hermes is used to execute untrusted...

CVE-2023-24833

A use-after-free in BigIntPrimitive addition in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by an attacker to leak raw data from Hermes VM’s heap. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most...

CVE-2023-23557

An error in Hermes' algorithm for copying objects properties prior to commit a00d237346894c6067a594983be6634f4168c9ad could be used by a malicious attacker to execute arbitrary code via type confusion. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScrip...

CVE-2023-24832

A null pointer dereference bug in Hermes prior to commit 5cae9f72975cf0e5a62b27fdd8b01f103e198708 could have been used by an attacker to crash an Hermes runtime where the EnableHermesInternal config option was set to true. Note that this is only exploitable in cases where Hermes is used to execut...

Malicious code in hermes-inspector-msggen (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c888d12bd2fd1107fe758f38e0e220f18fe717c6524edc4edc0478727a63bf6a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-32234

An out of bounds write in hermes, while handling large arrays, prior to commit 06eaec767e376bfdb883d912cb15e987ddf2bda1 allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted...